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Information Commissioner's Office 


Freedom of Information Act 2000 (Section 48) 


Practice Recommendation 


Date: 11 July 2022 
Public Authority: Department of Health & Social Care 
Address: 39 Victoria Street 
London 
SW1H OEU 
Foreword 


In response to the notices that we issued, the Department of Health & 
Social Care (DHSC) sent out a questionnaire to a wide range of staff to 
identify information that may be caught within their scope. As part of this 
exercise, DHSC notified us that it had identified that official information 
had been shared through: 


29 private WhatsApp accounts; 
17 private text accounts; 

8 private email accounts; and 
1 private LinkedIn account 


In July 2021, the Information Commissioner received complaints, 
including from the COVID-19 Bereaved Families for Justice 
Campaign, about media reports in the Sunday Times regarding the 
alleged use of private correspondence channels by Ministers in the 
DHSC to conduct official government business during the 
pandemic. 


In particular, the Campaign set out their concerns about what such 
practices, if happening, “may mean for those seeking transparency 
and accountability regarding the many life and death decisions 
taken in the Department of Health during the pandemic”. 


They also raised questions about any potential implications for the 
subsequent Inquiry into the handling of COVID-19 that the UK 
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Government had already committed to at the time of the media 
reports. 


After consideration of the information available at that point, on 6 
July 2021, the then Commissioner announced?! that she was 
launching an investigation into the alleged use of private 
communication channels at the DHSC. This included investigating 
DHSC’s Freedom of Information Act (FOIA) handling practices. 


The Commissioner is required by law to ensure compliance with a 
range of information rights legislation. Under FOIA, there are codes 
of practice that the Commissioner is required to promote about 
how departments should manage information and the handling of 
FOI requests. 


The Commissioner issued a FOIA Information Notice (IN) to DHSC 
on 5 July 2021, requiring it to provide specific information by a set 
deadline, 6 August 2021. DHSC requested and were given 
extensions to this deadline. 


On 17 September, DHSC, as requested, provided an indicative 
timeline for providing the outstanding information by 31 October 
and confirmed its agreement to an on-site visit at DHSC. 


A virtual site visit took place on 7 October 2021 and an on-site 
visit followed on 25 October 2021. DHSC gave a presentation 
during the on-site visit which included some informative 
information and illustrative examples. However, when asked to 
send this presentation and information to the Commissioner to 
assist with the investigation, DHSC stated it would not provide it. 


Prior to the virtual site visit, DHSC provided some additional 
information on 4 October 2021. This was mainly around when it 
communicated relevant policies and procedures to staff, officials, 
Ministers and SPADs; information about the use of private 
communications channels; and a log of FOI requests over a set 
period. 


The Commissioner has now investigated and considered in detail 
the information and explanations DHSC has provided in response 
to the FOIA IN and the subsequent follow-up enquiries. 


The Commissioner has reached the view that DHSC’s request 
handling practices do not conform to the section 45 Freedom of 
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Information Code of Practice, issued by the Cabinet Office in July 
2018 (the Code). 


12. The Commissioner considers that DHSC’s practices do not conform 
with the following sections of the code: 


e Part 1 - relating to right of access 
e Part 4 - relating to time limits for responding to requests 
e Part 10 - relating to communication with the requester 


13. Therefore, in accordance with section 48(1) of the Freedom of 
Information Act 2000 (FOIA), the Commissioner has elected to 
issue the following practice recommendation in relation to DHSC’s 
performance under the s.45 Code. The Commissioner has also 
made broader recommendations to the UK Government as a whole 
in relation to its record management practices in a separate report 
he has laid before Parliament. This recommendation should be 
read alongside that report, which provides further detail on the 
evidence informing this practice recommendation. 


Summary 


14. Given the practice at DHSC of some Ministers and Non-Executive 
Directors using non-corporate, private correspondence and 
communication channels for conducting official business, the 
Commissioner has genuine concerns that information which should 
form part of DHSC’s official record may not have been retained or 
accessible for the purposes of properly responding to legitimate 
FOI requests. These practices, which senior officials within DHSC 
were aware of, had the effect of undermining the concept of all 
official information being held and accessible via a single 
corporately controlled system. 


15. To ensure that information relevant to our investigation was 
appropriately retained a FOIA IN was issued. It required 
information including: 


e any policies used by DHSC to inform its compliance with FOIA 
and its related codes; 

e copies of emails sent to and from private correspondence 
channels by departmental accounts, including any summaries 
made by private offices and others, and to give an outline of 
these exchanges; and 

e examples of recorded contact with Ministers to confirm checks 
of private email accounts to inform responses to FOIA requests. 
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In practice, DHSC required multiple extensions and provided 
information in response to the FOIA IN in stages in August, 
September and October 2021, and January 2022. Subsequent 
enquiries made on 3 February were responded to on 11 March 
2022. DHSC did request extensions throughout the course of the 
investigation. It provided the reasons and explanations why it 
needed such extensions. 


Nature of non-conformity 


173 


18. 


19. 


20. 


The actions of DHSC in response to the IN indicate that its 
handling of non-corporate communications was not consistent with 
the expectations set out in the s.45 code. 


It is clear that the use of non-corporate messaging services was 
allowed to increase without co-ordinated oversight of their control 
and use. There was confusion about who ultimately controlled 
access and there was little, if any, evidence of control of the 
ongoing departmental access for retrieval or security 
requirements. 


During the investigation, DHSC wrote to the ICO confirming that it 
had located one example of Ministers being requested to search 
their records for the purposes of an FOI request. Following review 
of DHSC’s request log, the ICO requested information about 
whether a similar process had been followed in relation to eight 
specific requests, where it seemed likely such searches may also 
have been necessary. DHSC refused to provide specific details of 
the search processes it adopted when dealing with these eight 
requests. It challenged whether the IN actually covered this line of 
inquiry and suggested such searches would be too burdensome. 
The Commissioner can only conclude in light of the evidence 
available that it is likely such searches did not take place in at least 
some of these requests. 


The Commissioner considers that the practices of DHSC in relation 
to the exercise of its functions under FOIA do not conform with 
parts 1, 4 and 10 of the code. 


Part 1 — Right of access 


2]; 


Section 1.1 of the code sets out requestors’ rights to be informed 
whether or not the public authority “holds information meeting the 
description set out in the request”. 
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22. During the course of the Commissioner’s investigation it became 
clear, as is evidenced by the specific examples in the section 
below, that this right was not being met. 


23. It is also clear from the evidence provided by DHSC, that this right 
of access was not met on numerous occasions, as referred to in 
paragraph 29 below, during the period considered in the 
Commissioner’s investigation. 


Part 4 - time limits for responding to requests 


24. Section 4.1 of the code highlights the “clear” requirement that 
public authorities respond to requests for information promptly, 
and within 20 working days of receipt. It should be noted that this 
was in the context of a significant increase in information requests 
to DHSC, at a time when resources were extremely stretched as a 
result of the pandemic. The Commissioner has taken this into 
account in formulating his regulatory approach. 


25. In this case, significant numbers of requesters did not receive a 
response to their information requests in the period considered by 
the Commissioner. Many who did receive responses, received them 
well outside of the expected, in the majority of cases, 20 working 
days. 


26. Based upon the information initially provided by DHSC on 4 
October 2021, there were 18 requests over 12 months old; 27 
requests over nine months old; 21 requests over six months old; 
and 113 requests over three months old. 


27. The Commissioner asked for further information about eight 
specific requests on 3 February 2022 (six of which had still been 
outstanding as at 4 October 2021); a limited response was 
provided by DHSC on 11 March. This information confirmed that 
five of the six outstanding requests had received responses since 
the FOI log was originally provided on 4 October 2021. 


DHSC reference | Date of request Date of response 
1268836 | 04/11/20 24/02/22 
1298943 29/01/21 11/03/22 
1308894 23/02/21 28/02/22 
1330417 14/05/21 Ongoing 
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1341025 28/06/21 10/03/22 


1341231 29/06/21 18/10/21 


Part 10 — Communicating with the requester 


28. Section 10.2 of the code states that initial responses to requests 
for information should include: 


e a statement that the request has been dealt with under the 
Act; 


e confirmation that the requested information is held or not 
held by the public authority or a statement neither 
confirming or denying whether the information is held; 


e the process, contact details and timescales for the public 
authority’s internal review appeals process; 


e information about the applicant’s further right of appeal to 
the Information Commissioner and contact details for the 
Information Commissioner’s Office; and 


e if some or all of the information cannot be disclosed, details 
setting out why this is the case, including the sections (with 
subsections) the public authority is relying on if relevant. 
When explaining the application of named exemptions, 
however, public authorities are not expected to provide any 
information which is itself exempt. 


29. Given the evidence in the preceding section on “time limits”, it is 
clear that DHSC has again, in numerous cases, failed to conform 
with the rights of individual requesters. Again, this is in the context 
of the volume increases and wider pandemic pressures noted 
above that the Commissioner has taken into account. 


Action recommended 


30. In relation to parts 1, 4 and 10 of the code, DHSC must ensure it 
has appropriate procedures in place to both record and have 
access to official records. This is necessary to meet its obligations 
and respond fully, accurately and appropriately to information 
requests. Also, DHSC must ensure that it issues responses that 
give effect to the requester’s rights of access within 20 working 
days of receipt of the request. The Commissioner recommends that 
DHSC should take the following steps to ensure conformity with 
the Section 45 code: 
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e Update guidance for staff on the use of non-corporate 
channels so it is consistent across the different policies 
currently used by the department. Cabinet Office have 
previously indicated that it is updating its own guidance on 
the use of private correspondence channels, which has been 
in place since 2013. The Commissioner will work with Cabinet 
Office, DHSC and others as needed to support the 
development of this new guidance. 


e Establish a centrally held register of the individuals permitted 
to use private channels and devices. 


e Establish a process for granting this permission that includes 
confirmation of how, and with what frequency, official 
information will be transferred onto official systems. This 
should include specific provision for when individuals leave the 
department suddenly including, for example, following a 
Ministerial reshuffle. 


e Review and update DHSC’s existing information request 
handling policies and training to ensure they are consistent 
with the changes made in response to the measures outlined 
above. 


e Follow up with any DHSC Ministers, Non-Executive Directors 
or senior staff who have left during the pandemic period who 
may have used private devices and correspondence channels 
to seek confirmation in writing that all relevant records have 
been transferred onto the department’s systems and seek to 
secure these where this may not be the case. 


e In light of any material that may be received as part of this 
exercise, review its FOI request log to ensure that this 
information, if relevant to any requests, is considered for 
release. 


e Write to the Commissioner by the deadline set out in the 
notice to confirm that it has complied with its 
recommendations and how it has achieved this. 


31. Furthermore, in relation to part 4 of the code, the Commissioner 
recommends that DHSC should consider using the Commissioner’s 
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FOI self-assessment toolkit to improve its timeliness compliance. 
It is noted that DHSC has already taken steps to improve its 
performance since the highest point of the pandemic, which is 
welcomed. 


In relation to part 10 of the code, DHSC should ensure that it 
communicates with applicants in accordance with their rights, as 
set out above. 


The Commissioner will review progress in these matters after three 
months to assess the improvements in these areas and feedback 
his observations to DHSC. 


Failure to comply 


34. 


35. 


A practice recommendation cannot be directly enforced by the 
Commissioner. However, failure to comply with a practice 
recommendation may lead to a failure to comply with FOIA, which 
in turn may result in further regulatory action. Further, a failure to 
take account of a practice recommendation may lead in some 
circumstances to an adverse comment in a report to Parliament by 
the Commissioner. 


The Commissioner will have regard to this practice 
recommendation in his handling of subsequent cases involving 


Warren Seddon 

Director of FoI & Transparency 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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